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REMARKS 

Applicant appreciates the courtesy of the teleconference 
on September 21, 2001. This Application has been carefully 
reviewed in light of the Final Official Action mailed July 24, 
2001 and the referenced teleconference. In an effort to 
advance prosecution of this case, Applicant requests 
cancellation of Claims 1-8, 14-21, and 25 without prejudice or 
disclaimer. Claims 9-13, 22-24, and 26 remain pending. 
Applicant respectfully requests reconsideration and favorable 
action in this case. 



Official Notice 

Applicant notes that Examiner relies upon only one 
reference, U.S. Patent No. 5,919,247 issued to Van Hoff, et 
al . ("Van Hoff"), in his rejection of all of the claims in the 
instant Application. Despite the Examiner's burden to 
establish a prima, facie case of obviousness, Examiner merely 
cites Van Hoff along with conclusory statements such as 
"common wisdom practice," "would become apparent", "would have 
been obvious," and "well known." In Applicant's response of 
April 27, 2 001, Applicants seasonably traversed such 
statements as an attempt . to take Official Notice, and 
requested that the Examiner cite references in support of 
these statements pursuant to MPEP § 2144.03. In response to 
this traverse, the Examiner refused to provide such 
references , stating : 



Applicants . . . have attempted to challenge the 
Examiner f s common wisdom practice/Official Notice; 
however, Applicants have not provided adequate 
information or argument so that on its face it 
creates a reasonable doubt regarding the 
circumstances justifying the Official notice. 
Therefore, the presentation of a reference to 
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substantiate the Official Notice is not deemed 
necessary. . . . See In re Boon, 169 USPQ 231 (CCPA 
1971) . 

It is respectfully submitted that Examiner's reliance upon 
Boon is misplaced. First, the facts of Boon involve a 
situation where the taking of Official Notice was supported by 
the citation of a reference (a dictionary) . Thus, there is 
nothing in the holding of Boon which even remotely stands for 
the proposition that a reference need not be cited on request 
in order to support an instance of Official Notice. Moreover, 
and more important, Boon related to the taking of judicial by 
the Board of Appeals. There is nothing in Boon that suggests 
Boon gives an Examiner the right to refuse to cite a reference 
in response to a traverse of an Examiner's taking of Official 
Notice. MPEP § 2144.03 itself cites Boon but does not even 
remotely suggest that the holding of Boon extends to 
Examiners. In fact, MPEP § 2144.03 has a completely separate 
paragraph which deals specifically with Examiners, and which 
specifies what must happen if an applicant challenges the 
taking of Official Notice by an Examiner. In particular, the 
MPEP expressly states that if "the applicant traverses such an 
assertion the Examiner should cite a reference in support of 
his or her position. " 

Section 102 of Title 35 of the United States Code 
specifies that an applicant "shall be entitled to a patent 
unless" the Patent Office successfully carries the burden of 
producing evidence to show that, the invention is not 
patentable. By refusing to cite a reference in this support 
of the Official Notice taken in the present application, the 
Examiner is failing to provide the required evidence. The 
Examiner is attempting to shift to Applicants the burden of 
proving patentability, which is effectively the burden of 
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proving a negative, and the Examiner's approach is directly 
contrary to U.S. patent law. The Examiner has failed to cite 
any statute or case which supports his position that the PTO 
does not expect that an examiner will cite a reference when an 
applicant requests one. (As noted above, the only case cited 
by the Examiner is Boon, which involved a situation where a 
reference was cited to support the Official Notice) . 
In addition to failing to meet his evidentiary burden, the 
Examiner, by failing to provide references despite Applicant's 
explicit, proper, and seasoned requests to do so, denies the 
Applicant any meaningful opportunity to examine or challenge 
the statements made by the Examiner, and in doing so violates 
Applicant's right to administrative due process. 

Information Disclosure Statement 

Examiner states that "non-patent documents listed on the 
[Information Disclosure Statement] paper no. 2, in particular 
at pages 2-10 now being considered for the claimed merit of 
distributing and/or updating program subject matters only and 
not for, or regardless, unclaimed intrusion detection system 
and/or techniques per se, as Applicant acknowledged." 
Applicant respectfully states that Applicant recalls "making no 
such acknowledgement and hereby traverses Examiner's statement 
to the extent that it reduces in any way the full 
consideration to which the IDS is entitled under USPTO rules 
and regulations. 

Section 103 Rejections 

As noted above, the Examiner rejects Claims 1-2 6 under 35 
U.S.C. § 103(a) as being unpatentable over U.S. Patent No. 
5,919,247 issued to Van Hoff, et al . ("Van Hoff"). Claims 1- 
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8, 14-21, and 25 have been cancelled without prejudice or 
disclaimer, rendering Examiner's rejections of Claims 1-8, 14- 
21, and 25 moot. Applicant respectfully traverses Examiner's 
rejections of the remaining claims pending in the Application. 
With respect to each of the pending claims, to the extent that 
the Examiner relies on "common wisdom practice" or supposedly 
"apparent," "obvious, "or "well known" knowledge, Applicant 
respectfully, and again, traverses these assertions and again 
requests pursuant to M.P.E.P. § 2144.03 that the Examiner cite 
a reference in support of the Examiner's position. 

In rejecting Claim 9 under 35 U.S.C. § 103(a), Examiner 
simply restates his previous rejection language. Again, 
Applicant respectfully submits that nothing in the cited art 
suggests, as recited by Claim 9, restoring a first version of 
a program for operation at a network site when, after 
installation of a downloaded update, it is determined that the 
update is operating incorrectly. Applicant respectfully 

disputes Examiner's assertion that Van Hoff suggests such 
restoring. Instead, Van Hoff, as relied upon by the Examiner, 
merely teaches the use of a "holding space" to "store data 
received as part of update replies." Van Hoff, col. 9, 11. 
11-12. The update reply commands are not immediately applied 
because "modification of program code or data may corrupt 
channel application 153 if that application is running at the 
time of the updates." Van Hoff, col. 9, lines 19-22 (emphasis 
added) . "Instead the changes from holding space 156 are 
applied either when channel application 153 terminates, or 
when channel application 153 explicitly requests so, thus 
bringing the channel up to date." Col. 9, lines 23-25. Thus, 
Van Hoff's teachings are limited to holding off an update 
until an application is ready. There is no teaching of 
restoring a first version of a program, much less determining 
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whether a second version is operating correctly. In addition, 
because the holding space of Van Hoff is for unapplied 
updates, there is no "means" for retrieving a previous version 
as asserted by the Examiner. Moreover, because Van Hoff 

waits until after "modification of program code or data may 
corrupt [the] channel application" before applying the change, 
there is no reason to add a restoration system to Van Hoff as 
it adds cost without benefit. Thus, Claim 9 is not taught or 
suggested by the cited art . 

With respect to Claim 10, Examiner again simply restates 
his previous rejection language. However, as stated by the 
Applicant in his response to the Examiner's language, there is 
no suggestion or motivation in the cited art to add 
"distributing the downloaded update to a disparate network 
site operating the first version" as in Claim 10. In 
contrast, in Van Hoff, a transmitter process calculates 
client-specific differences and a set of commands used to 
update the channel data. Col. 5, lines 22-29. Because the 
channel update is client specific, it is unsuitable for this 
distribution. Thus, the modification to Van Hoff suggested by 
the Examiner would render Van Hoff unsuitable for its intended 
purpose as an update specific for one client would be applied 
to another client needing a different update. Therefore, 
Claim 10 is not taught or suggested by the cited art. 

With respect to Claim 11, Examiner again simply restates 
his previous rejection language. Similar to Claim 10, Claim 
11 recites distributing the downloaded update to a disparate 
network site operating the first version. Thus, Claim 11 is 
patentable over the cited art. 

With respect to Claim 12, Examiner again simply restates 
his previous rejection language. The abstract of Van Hoff, 
relied upon by the Examiner, teaches against broadcasting 
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distribution of software. The abstract teaches that "the 
client initiates each update request without requiring any 
special broadcast networking infrastructure." Moreover, there 
is no teaching in Van Hoff for a program to automatically 
broadcast an update message to other programs, after an update 
has been automatically downloaded by the first program from a 
remote site. Thus, there is no suggestion or motivation in 
Van Hoff for "broadcasting over a network an update message" 
within the context of in Claim 12 . Absent such suggestion or 
motivation, the rejection is improper. See MPEP § 2143.01. 

With respect to Claim 13, Examiner again simply restates 
his previous rejection language. Claim 13, like Claim 9, 
recites restoring a first version of a program for operation 
at a network site when, after installation of a downloaded 
update, it is determined that the update is operating 
: V^orrectly. As above, Applicant respectfully submits that 
^no'Ching in the cited art suggests, as recited by Claim 13, 
restoring a first version of a program for operation at a 
network site when, after installation of a downloaded update, 
it is determined that the update is operating incorrectly. 
Indeed, as discussed above, Van Hoff teaches against these 
elements . 

With respect to Claim 22, Examiner again simply restates 
his previous rejection language. However, as above, there is 
no suggestion or motivation in the cited art to add intrusion 
detection sensors to "distribute the downloaded update to the 
remaining intrusion detection sensors for installation." 
Applicant thus respectfully submits that Claim 22 and its 
dependent Claims 23-24 are patentable over Van Hoff. 
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Conclusions 



Applicant has made an earnest attempt to place this case 
in condition for allowance. For the foregoing reasons, and 
for other reasons clearly apparent, Applicant respectfully 
requests full allowance of all pending Claims. 

If the Examiner feels that a telephone conference or an 
interview would advance prosecution of this Application in any 
manner, the undersigned attorney for Applicant stands ready to 
conduct such a conference at the convenience of the Examiner. 

The Commissioner is hereby authorized to charge any fees 
or credit any overpayments to Deposit Account No. 02-0384 of 
Baker Botts L.L.P. 



Respectfully submitted, 



BAKER BOTTS L.L.P. 
Attorneys for Applicant 




2 001 Ross Avenue 
Dallas, Texas 75201-2980 
(214) 953-6477 




CORRESPONDENCE ADDRESS: 
Baker Botts L.L.P. 
2 001 Ross Avenue, Suite 60 0 
Dallas, TX 75201-2980 



DAL01:623167.1 



ATTORNEY DOCKET NO. 062891.0240 PATENT 

Serial No. 09/241,823 

16 

Marked-Up Version of Claim Amendments 

For the convenience of the Examiner, all claims have been 
presented whether or not an amendment has been made . The 
claims have been amended as follows. 

Please amend the claims as follows. 

Please cancel Claims 1-8 without prejudice or disclaimer. 

9. A method for updating a first version of a program 
operating at a network site, comprising: 

in response to an automated event, automatically 
downloading from a remote site any update for the program; 

installing a downloaded update to generate a second 
version of the program; 

after installation of the downloaded update, determining 
whether the second version of the program is operating 
correctly; 

in response to correct operation of the second version, 
operating the second version of the program in place of the 
first version at the network site; and 

in response to incorrect operation of the second version, 
restoring the first version of the program for operation at 
the network site. 
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10. A method for updating a first version of a program 
operating at a network site, comprising: 

in response to an automated event, automatically 
downloading from a remote site any update for the program; 

installing a downloaded update to generate a second 
version of the program; and 

operating the second version of the program in place of 
the first version at the network site; 

distributing the downloaded update to a disparate network 
site operating the first version of the program; 

installing the downloaded update to generate the second 
version of the program at the disparate network site; and 

operating the second version of the program in place of 
the first version at the disparate network site. 
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11. A method for updating a first version of a program 
operating at a network site, comprising: 

in response to an automated event, automatically 
downloading from a remote site any update for the program; 

installing a downloaded update to generate a second 
version of the program; 

after installation of the downloaded update, determining 
whether the second version of the program is operating 
correctly at the network site; 

in response to incorrect operation of the second version, 
restoring the first version of the program for operation at 
the network site; and 

in response to correct operation of the second version at 
the network site: 

distributing the downloaded update to a disparate 
network site operating the first version of the program; 

installing the downloaded update to generate the 
second version of the program at the disparate network site; 
and 

operating the second version of the program in place 
of the first version at the disparate network site. 
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12. A method for updating a first version of a program 
operating at a network site, comprising: 

in response to an automated event, automatically 
downloading from a remote site any update for the program; 

installing a downloaded update to generate a second 
version of the program; and 

operating the second version of the program in place of 
the first version at the network site; 

broadcasting over a network an update message; 

receiving in response to the update message a request for 
the downloaded update from each of a plurality of disparate 
network sites operating the first version of the program; 

distributing the downloaded update to the disparate 
network sites requesting the downloaded update; 

installing the downloaded update to generate the second 
version of the program at each of the disparate network sites; 
and 

operating the second version of the program in place of 
the first version at each of the disparate network sites. 

13. The method of Claim 12, further comprising: 
receiving a recovery event at one of the network sites; 
automatically restoring the first version of the program 

at the network site at which the recovery event was received; 

broadcasting a recovery message from the network site 
over the network; and 

automatically restoring the first version of the program 
at each of the remaining network sites operating the second 
version of the program. 

Please cancel Claims 14-21 without prejudice or 
disclaimer . 
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22. An intrusion detection system, comprising: 

a private network including a plurality of sites 
connected to a public network, each site including an 
intrusion detection sensor operating with a first set of 
intrusion detection signatures; and 

each of the intrusion detection sensors operable to 
automatically download from a remote site any update for the 
intrusion detection signatures in response to a specified 
event, to install a downloaded update to generate a second set 
of intrusion detection signatures, to operate with the second 
set of intrusion detection signatures, and to distribute the 
downloaded update to the remaining intrusion detection sensors 
for installation. 

23. The system of Claim 22, wherein the specified event 
is an automated event. 

24. The system of Claim 23, wherein the automated event 
is a timed event. 

Please cancel Claim 25 without prejudice or disclaimer. 

26. The method of Claim 13 wherein the recovery event 
occurs in response to incorrect operation of the intrusion 
detection program. 
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